Compared defense methods.
We compare MixDefense with two competing detection-based defenses FS [1]} and MagNet [2]} on the accuracy of detector (\(Acc_{\text{Detector}}\) ); and with FS [1]}, MagNet [2]} and one of the most strongest training-based defense known today, Madry [5]}, on the accuracy of robust classifier (\(Acc_{\text{RC}}\) ).
The selected methods are representative AE defense methods from the three categories surveyed in Section REF , where Madry boosts model robustness through adversarial training, MagNet alleviates the impact of AEs through input transformation, and FS detects AEs based on the prediction inconsistency.
All three methods are implemented based on their open-source official code. Note that, since the adversarial training is time-consuming, we only test Mardry on MNIST and CIFAR10, and use the pre-trained models provided by the authors.
